%% Atlas service access architecture. %% Domains, identity profiles, entry services, and selected internal dependencies. %% Node placement and short labels carry the detail. %%{init: {"flowchart": {"defaultRenderer": "elk", "curve": "stepAfter", "nodeSpacing": 30, "rankSpacing": 65, "useMaxWidth": false}, "elk": {"mergeEdges": true, "nodePlacementStrategy": "LINEAR_SEGMENTS", "forceNodeModelOrder": true, "considerModelOrder": "NODES_AND_EDGES"}, "themeVariables": {"background": "#000000", "lineColor": "#8b95a5", "primaryTextColor": "#ffffff", "clusterBkg": "#03040d", "clusterBorder": "#6d7485"}, "themeCSS": "& { background-color: #000000 !important; }"}}%% flowchart TB subgraph system["Atlas Service Access Architecture"] direction TB subgraph legend["Legend"] direction LR subgraph node_key["Nodes"] direction LR key_domain["DNS name"]:::domain key_access["OIDC access"]:::access key_oauth["Access proxy"]:::oauth key_directory["LDAP or synced account"]:::directory key_entry["Entry service"]:::user key_internal["Internal service"]:::support key_data["Data service"]:::data key_job["Job or worker"]:::ephemeral key_external["Outside Kubernetes"]:::external end subgraph link_key["Links"] direction LR key_ingress["Blue
Domain to identity"]:::linkIngress key_service["Green
Identity to service"]:::linkService key_direct["Gold
Direct access"]:::linkDirect key_auth["Purple
Identity control"]:::linkAuth key_data_link["Violet
Data flow"]:::linkData key_telemetry["Teal
Telemetry"]:::linkTelemetry key_control["Orange
Delivery and control"]:::linkControl key_internal_link["Gray
Internal flow"]:::linkInternal end end subgraph application_band["Applications and Communications"] direction LR subgraph application_domains["Domains"] direction TB portal_domain["bstein.dev"]:::domain portal_chat_domain["chat.ai.bstein.dev"]:::domain cassandra_domain["cassandra.bstein.dev"]:::domain element_domain["live.bstein.dev"]:::domain matrix_domain["matrix.live.bstein.dev"]:::domain call_domain["call.live.bstein.dev"]:::domain livekit_domain["kit.live.bstein.dev"]:::domain turn_domain["turn.live.bstein.dev"]:::domain end subgraph application_access["Keycloak Access"] direction LR subgraph application_atlas_access["atlas realm"] direction TB portal_oidc_access["Portal API
OIDC token"]:::access portal_chat_oidc_access["Portal Chat
OIDC"]:::access element_oidc_access["Element Web
OIDC through MAS"]:::access matrix_oidc_access["Matrix
OIDC through MAS"]:::access end subgraph application_cassandra_access["cassandra realm"] direction TB cassandra_oidc_access["Cassandra
OIDC"]:::access end end subgraph application_services["Cluster Services"] direction TB application_delivery["Flux delivery
Application workloads"]:::control application_state_clients["Shared PostgreSQL
Portal and Matrix"]:::control subgraph website_ns["bstein-dev-home"] direction LR website_frontend["Portal"]:::user website_chat_gateway["Chat gateway"]:::user website_backend["Backend"]:::support website_frontend --> website_backend website_chat_gateway --> website_backend end subgraph cassandra_ns["cassandra"] direction LR cassandra_frontend["Cassandra UI"]:::user cassandra_backend["API"]:::support cassandra_postgres["PostgreSQL"]:::data cassandra_generator["Generator"]:::ephemeral cassandra_simulation["Simulation jobs"]:::ephemeral cassandra_retention["Retention job"]:::ephemeral cassandra_artifacts["Artifacts"]:::data cassandra_frontend --> cassandra_backend cassandra_backend --> cassandra_postgres cassandra_generator --> cassandra_backend cassandra_simulation --> cassandra_backend cassandra_simulation --> cassandra_artifacts cassandra_retention --> cassandra_artifacts end subgraph comms_ns["comms"] direction LR comms_element_web["Element Web"]:::user comms_element_call["Element Call"]:::user comms_wellknown["Matrix discovery"]:::support comms_guest["Guest registration"]:::support comms_mas["Matrix auth service"]:::support comms_synapse["Synapse"]:::support comms_replication["Synapse replication"]:::support comms_redis["Redis"]:::data comms_livekit_token["LiveKit token service"]:::support comms_livekit["LiveKit"]:::support comms_coturn["Coturn"]:::support comms_atlasbot["Atlasbot"]:::support comms_element_web --> comms_mas comms_element_web --> comms_synapse comms_element_call --> comms_livekit_token comms_livekit_token --> comms_livekit comms_mas --> comms_synapse comms_synapse --> comms_replication comms_synapse --> comms_redis comms_guest --> comms_synapse comms_atlasbot --> comms_synapse end end portal_domain portal_identity@-->|HTTPS| portal_oidc_access portal_oidc_access portal_entry@--> website_frontend portal_chat_domain portal_chat_identity@-->|HTTPS| portal_chat_oidc_access portal_chat_oidc_access portal_chat_entry@--> website_chat_gateway cassandra_domain cassandra_identity@-->|HTTPS| cassandra_oidc_access cassandra_oidc_access cassandra_entry@--> cassandra_frontend element_domain element_identity@-->|HTTPS| element_oidc_access element_oidc_access element_entry@--> comms_element_web matrix_domain matrix_identity@-->|HTTPS| matrix_oidc_access matrix_oidc_access matrix_entry@--> comms_synapse matrix_domain matrix_api@-->|Matrix API| comms_synapse call_domain call_entry@-->|HTTPS| comms_element_call livekit_domain livekit_entry@-->|HTTPS and WebRTC| comms_livekit turn_domain turn_entry@-->|TURN| comms_coturn end subgraph personal_band["Personal Services"] direction LR subgraph personal_domains["Domains"] direction LR subgraph personal_domains_a["Accounts and Health"] direction TB budget_domain["budget.bstein.dev"]:::domain firefly_domain["money.bstein.dev"]:::domain wolf_domain["wolf.bstein.dev"]:::domain moonlight_domain["moonlight.bstein.dev"]:::domain wger_domain["health.bstein.dev"]:::domain chat_domain["chat.bstein.dev"]:::domain end subgraph personal_domains_b["Media and Productivity"] direction TB jellyfin_domain["stream.bstein.dev"]:::domain pegasus_domain["pegasus.bstein.dev"]:::domain mailu_domain["mail.bstein.dev"]:::domain cloud_domain["cloud.bstein.dev"]:::domain office_domain["office.bstein.dev"]:::domain outline_domain["notes.bstein.dev"]:::domain planka_domain["tasks.bstein.dev"]:::domain vaultwarden_domain["vault.bstein.dev"]:::domain monero_domain["monero.bstein.dev"]:::domain end end subgraph personal_access["atlas realm and directory access"] direction LR subgraph personal_access_a["Accounts"] direction TB budget_oidc_access["Actual Budget
OpenID"]:::access firefly_synced_access["Firefly
Synced account"]:::directory wolf_oauth_access["Wolf
Access proxy"]:::oauth wger_synced_access["Wger
Synced account"]:::directory chat_oidc_access["Hermes Chat
OIDC"]:::access end subgraph personal_access_b["Media and Productivity"] direction TB jellyfin_ldap_access["Jellyfin
LDAP"]:::directory cloud_oidc_access["Nextcloud
OIDC"]:::access outline_oidc_access["Outline
OIDC"]:::access planka_oidc_access["Planka
OIDC"]:::access end end subgraph personal_services["Cluster Services"] direction LR personal_delivery["Flux delivery
Personal workloads"]:::control personal_state_clients["Shared PostgreSQL
Personal services"]:::control subgraph personal_services_a["Accounts, Health, and Media"] direction TB subgraph finance_ns["finance"] direction LR finance_budget["Actual Budget"]:::user finance_firefly["Firefly"]:::user finance_sync["Account sync"]:::ephemeral finance_import["Import job"]:::ephemeral finance_sync --> finance_firefly finance_import --> finance_firefly end subgraph game_ns["game-stream"] direction LR game_proxy["Wolf access proxy"]:::oauth game_manager["Wolf manager"]:::support game_api["Wolf API"]:::support game_wolf["Wolf"]:::support game_gatekeeper["Gatekeeper"]:::support game_moonlight["Moonlight"]:::user game_proxy --> game_manager game_manager --> game_api game_api --> game_wolf game_gatekeeper --> game_wolf game_moonlight --> game_wolf end subgraph health_ns["health"] direction LR health_wger["Wger"]:::user health_sync["Account sync"]:::ephemeral health_admin["Admin sync"]:::ephemeral health_sync --> health_wger health_admin --> health_wger end subgraph hermes_chat_ns["hermes-chat"] direction LR hermes_chat["Hermes Chat"]:::user end subgraph jellyfin_ns["jellyfin"] direction LR streaming_pegasus["Pegasus"]:::user streaming_jellyfin["Jellyfin"]:::user streaming_pegasus --> streaming_jellyfin end end subgraph personal_services_b["Mail and Productivity"] direction TB subgraph mail_ns["mailu-mailserver"] direction LR mail_front["Mail web"]:::user mail_protocols["Mail protocols"]:::user mail_admin["Admin"]:::support mail_dovecot["Dovecot"]:::support mail_postfix["Postfix"]:::support mail_rspamd["Rspamd"]:::support mail_clamav["ClamAV"]:::support mail_extractors["Tika and oletools"]:::support mail_redis["Redis"]:::data mail_front --> mail_admin mail_protocols --> mail_dovecot mail_protocols --> mail_postfix mail_postfix --> mail_rspamd mail_rspamd --> mail_clamav mail_rspamd --> mail_extractors mail_admin --> mail_redis end subgraph cloud_ns["nextcloud"] direction LR cloud_nextcloud["Nextcloud"]:::user cloud_collabora["Collabora"]:::support cloud_mail_sync["Mail sync"]:::ephemeral cloud_maintenance["Maintenance job"]:::ephemeral cloud_nextcloud --> cloud_collabora cloud_mail_sync --> cloud_nextcloud cloud_maintenance --> cloud_nextcloud end subgraph notes_tasks_ns["Notes and Tasks"] direction LR outline_service["Outline"]:::user outline_redis["Redis"]:::data planka_service["Planka"]:::user outline_service --> outline_redis end subgraph vaultwarden_ns["vaultwarden"] direction LR vaultwarden_service["Vaultwarden"]:::user end subgraph crypto_ns["crypto"] direction LR crypto_wallet["Wallet RPC"]:::support crypto_p2pool["P2Pool"]:::support crypto_monerod["Monerod"]:::user crypto_wallet --> crypto_monerod crypto_p2pool --> crypto_monerod end end end budget_domain budget_identity@-->|HTTPS| budget_oidc_access budget_oidc_access budget_entry@--> finance_budget firefly_domain firefly_identity@-->|HTTPS| firefly_synced_access firefly_synced_access firefly_entry@--> finance_firefly wolf_domain wolf_identity@-->|HTTPS| wolf_oauth_access wolf_oauth_access wolf_entry@--> game_manager moonlight_domain moonlight_entry@-->|Streaming| game_moonlight wger_domain wger_identity@-->|HTTPS| wger_synced_access wger_synced_access wger_entry@--> health_wger chat_domain chat_identity@-->|HTTPS| chat_oidc_access chat_oidc_access chat_entry@--> hermes_chat jellyfin_domain jellyfin_identity@-->|HTTPS| jellyfin_ldap_access jellyfin_ldap_access jellyfin_entry@--> streaming_jellyfin pegasus_domain pegasus_entry@-->|HTTPS| streaming_pegasus mailu_domain mail_web_entry@-->|HTTPS| mail_front mailu_domain mail_protocol_entry@-->|Mail protocols| mail_protocols cloud_domain cloud_identity@-->|HTTPS| cloud_oidc_access cloud_oidc_access cloud_entry@--> cloud_nextcloud office_domain office_entry@-->|WOPI| cloud_collabora outline_domain outline_identity@-->|HTTPS| outline_oidc_access outline_oidc_access outline_entry@--> outline_service planka_domain planka_identity@-->|HTTPS| planka_oidc_access planka_oidc_access planka_entry@--> planka_service vaultwarden_domain vaultwarden_entry@-->|HTTPS and local auth| vaultwarden_service monero_domain monero_entry@-->|RPC| crypto_monerod end subgraph platform_band["Platform Services"] direction LR subgraph platform_domains["Domains"] direction LR subgraph platform_domains_a["Delivery"] direction TB gitops_domain["cd.bstein.dev"]:::domain gitea_domain["scm.bstein.dev"]:::domain harbor_domain["registry.bstein.dev"]:::domain hermes_domain["agent.bstein.dev"]:::domain jenkins_domain["ci.bstein.dev"]:::domain end subgraph platform_domains_b["Operations"] direction TB logs_domain["logs.bstein.dev"]:::domain longhorn_domain["longhorn.bstein.dev"]:::domain grafana_domain["metrics.bstein.dev"]:::domain alerts_domain["alerts.bstein.dev"]:::domain quality_domain["quality.bstein.dev"]:::domain keycloak_domain["sso.bstein.dev"]:::domain vault_domain["secret.bstein.dev"]:::domain end end subgraph platform_access["Keycloak Access"] direction LR subgraph platform_access_a["atlas realm delivery"] direction TB gitops_oidc_access["Weave GitOps
OIDC"]:::access gitea_atlas_oidc_access["Gitea
atlas realm"]:::access harbor_oidc_access["Harbor UI
OIDC"]:::access hermes_oidc_access["Hermes Agent
OIDC"]:::access jenkins_oidc_access["Jenkins
OIDC"]:::access end subgraph platform_access_b["atlas realm operations"] direction TB logs_oauth_access["OpenSearch Dashboards
Access proxy"]:::oauth longhorn_oauth_access["Longhorn
Admin proxy"]:::oauth grafana_oidc_access["Grafana
OIDC"]:::access quality_oauth_access["SonarQube
Admin and developer proxy"]:::oauth keycloak_admin_access["Keycloak console
Realm admin"]:::access vault_oidc_access["Vault
Admin OIDC"]:::access end subgraph platform_access_c["cassandra realm client"] direction TB gitea_cassandra_oidc_access["Gitea
OIDC"]:::access end end subgraph platform_services["Cluster Services"] direction LR platform_delivery["Flux delivery
Platform workloads"]:::control platform_state_clients["Shared PostgreSQL
Platform services"]:::control subgraph delivery_services["Delivery and Automation"] direction TB subgraph flux_ns["flux-system"] direction LR flux_source["Source controller"]:::support flux_kustomize["Kustomize controller"]:::support flux_helm["Helm controller"]:::support flux_image_reflector["Image reflector"]:::support flux_image_automation["Image automation"]:::support flux_notification["Notification controller"]:::support flux_webhook["Webhook receiver"]:::support flux_weave["Weave GitOps"]:::user flux_source --> flux_kustomize flux_source --> flux_helm flux_image_reflector --> flux_image_automation flux_webhook --> flux_notification flux_weave --> flux_source end subgraph gitea_ns["gitea"] direction LR gitea_http["Gitea web"]:::user gitea_ssh["Gitea SSH"]:::support end subgraph harbor_ns["harbor"] direction LR harbor_portal["Harbor portal"]:::user harbor_core["Harbor core"]:::support harbor_jobservice["Job service"]:::support harbor_registry["OCI registry"]:::data harbor_redis["Redis"]:::data harbor_portal --> harbor_core harbor_jobservice --> harbor_core harbor_core --> harbor_registry harbor_core --> harbor_redis end subgraph hermes_ns["hermes"] direction LR hermes_agent["Hermes Agent"]:::user hermes_model_gate["Model gate"]:::support hermes_gpt_oss["gpt-oss:20b
Fallback model"]:::support hermes_agent --> hermes_model_gate hermes_model_gate --> hermes_gpt_oss end subgraph jenkins_ns["jenkins"] direction LR jenkins_service["Jenkins"]:::user jenkins_agents["Build agents"]:::ephemeral jenkins_service --> jenkins_agents end end subgraph operations_services["Operations"] direction TB subgraph logging_ns["logging"] direction LR logging_oauth_proxy["Dashboard proxy"]:::oauth logging_dashboards["OpenSearch Dashboards"]:::user logging_opensearch["OpenSearch"]:::data logging_fluent_bit["Fluent Bit"]:::support logging_otel["OpenTelemetry"]:::support logging_data_prepper["Data Prepper"]:::support logging_oauth_proxy --> logging_dashboards logging_dashboards --> logging_opensearch logging_fluent_bit --> logging_opensearch logging_otel --> logging_data_prepper logging_data_prepper --> logging_opensearch end subgraph longhorn_ns["longhorn-system"] direction LR longhorn_oauth_proxy["Longhorn proxy"]:::oauth longhorn_frontend["Longhorn UI"]:::user longhorn_backend["Longhorn manager"]:::data longhorn_webhooks["Admission and recovery"]:::support longhorn_oauth_proxy --> longhorn_frontend longhorn_frontend --> longhorn_backend longhorn_webhooks --> longhorn_backend end subgraph monitoring_ns["monitoring"] direction LR monitoring_grafana["Grafana"]:::user monitoring_victoria["VictoriaMetrics"]:::data monitoring_exporters["Cluster and node exporters"]:::support monitoring_gpu_exporters["GPU exporters"]:::support monitoring_quality_gateway["Quality gateway"]:::support monitoring_postmark["Postmark exporter"]:::support monitoring_vmalert["vmalert"]:::support monitoring_alertmanager["Alertmanager"]:::user monitoring_exporters --> monitoring_victoria monitoring_gpu_exporters --> monitoring_victoria monitoring_quality_gateway --> monitoring_victoria monitoring_postmark --> monitoring_victoria monitoring_victoria --> monitoring_grafana monitoring_vmalert --> monitoring_alertmanager end end subgraph security_services["Identity and Security"] direction TB subgraph quality_ns["quality"] direction LR quality_oauth_proxy["SonarQube proxy"]:::oauth quality_sonarqube["SonarQube"]:::user quality_exporter["Quality exporter"]:::support quality_oauth_proxy --> quality_sonarqube quality_exporter --> quality_sonarqube end subgraph sso_ns["sso"] direction LR sso_oauth_proxy["Shared access proxy"]:::oauth sso_keycloak["Keycloak"]:::user atlas_realm["atlas realm"]:::control cassandra_realm["cassandra realm"]:::control sso_openldap["OpenLDAP"]:::directory sso_jobs["Realm bootstrap and checks"]:::ephemeral sso_keycloak --> atlas_realm sso_keycloak --> cassandra_realm sso_jobs --> sso_keycloak end subgraph vault_ns["vault"] direction LR vault_service["Vault"]:::user vault_internal["Vault cluster service"]:::support vault_injector["Secret injector"]:::support vault_jobs["Configuration jobs"]:::ephemeral vault_service --> vault_internal vault_injector --> vault_service vault_jobs --> vault_service end end end gitops_domain gitops_identity@-->|HTTPS| gitops_oidc_access gitops_oidc_access gitops_entry@--> flux_weave gitea_domain gitea_atlas_identity@-->|HTTPS| gitea_atlas_oidc_access gitea_atlas_oidc_access gitea_atlas_entry@--> gitea_http gitea_domain gitea_cassandra_identity@-->|HTTPS| gitea_cassandra_oidc_access gitea_cassandra_oidc_access gitea_cassandra_entry@--> gitea_http gitea_domain gitea_ssh_entry@-->|SSH| gitea_ssh harbor_domain harbor_identity@-->|HTTPS| harbor_oidc_access harbor_oidc_access harbor_entry@--> harbor_portal harbor_domain harbor_registry_entry@-->|OCI| harbor_registry hermes_domain hermes_identity@-->|HTTPS| hermes_oidc_access hermes_oidc_access hermes_entry@--> hermes_agent jenkins_domain jenkins_identity@-->|HTTPS| jenkins_oidc_access jenkins_oidc_access jenkins_entry@--> jenkins_service logs_domain logs_identity@-->|HTTPS| logs_oauth_access logs_oauth_access logs_entry@--> logging_oauth_proxy longhorn_domain longhorn_identity@-->|HTTPS| longhorn_oauth_access longhorn_oauth_access longhorn_entry@--> longhorn_oauth_proxy grafana_domain grafana_identity@-->|HTTPS| grafana_oidc_access grafana_oidc_access grafana_entry@--> monitoring_grafana alerts_domain alerts_entry@-->|HTTPS| monitoring_alertmanager quality_domain quality_identity@-->|HTTPS| quality_oauth_access quality_oauth_access quality_entry@--> quality_oauth_proxy keycloak_domain keycloak_identity@-->|HTTPS| keycloak_admin_access keycloak_admin_access keycloak_entry@--> sso_keycloak vault_domain vault_identity@-->|HTTPS| vault_oidc_access vault_oidc_access vault_entry@--> vault_service end subgraph shared_plane["Shared Cluster Services"] direction LR subgraph ingress_plane["Ingress and Networking"] direction TB metallb_control["MetalLB
Service addresses"]:::control traefik_service["Traefik
Load balancer"]:::support traefik_controller["Traefik
TLS and routing"]:::support cert_manager["cert-manager"]:::support cert_webhooks["Certificate webhooks"]:::support metallb_control --> traefik_service traefik_service --> traefik_controller cert_webhooks --> cert_manager cert_manager --> traefik_controller end subgraph shared_state["Shared State and Models"] direction TB postgres_service["Shared PostgreSQL
Application and platform databases"]:::data ai_ollama["Ollama
Local model service"]:::support default_zot_proxy["Zot access proxy"]:::oauth end subgraph maintenance_ns["maintenance"] direction TB maintenance_ariadne["Ariadne"]:::support maintenance_metis_proxy["Metis proxy"]:::oauth maintenance_metis["Metis"]:::support maintenance_soteria_proxy["Soteria proxy"]:::oauth maintenance_soteria["Soteria"]:::support maintenance_node_ops["Node operations"]:::ephemeral maintenance_jobs["Repair and migration jobs"]:::ephemeral maintenance_metis_proxy --> maintenance_metis maintenance_soteria_proxy --> maintenance_soteria maintenance_ariadne --> maintenance_node_ops maintenance_ariadne --> maintenance_jobs end subgraph telemetry_services["Additional Telemetry"] direction TB climate_typhon["Typhon
Tent climate"]:::support sui_metrics["SUI metrics"]:::support end end subgraph external_systems["Host and Physical Systems"] direction LR ananke_hosts["Ananke
titan-db and titan-24"]:::external pyrphoros["Pyrphoros UPS"]:::external statera["Statera UPS"]:::external tent_system["AC Infinity
Controller and cloud"]:::external ananke_hosts --> pyrphoros ananke_hosts --> statera end firefly_synced_access firefly_directory@-.-> sso_openldap wger_synced_access wger_directory@-.-> sso_openldap jellyfin_ldap_access jellyfin_directory@-.-> sso_openldap website_backend website_model@-.-> ai_ollama website_backend website_automation@-.-> maintenance_ariadne hermes_chat hermes_chat_model@-.-> hermes_model_gate hermes_agent hermes_jenkins@-.-> jenkins_service hermes_agent hermes_metrics@-.-> monitoring_victoria hermes_agent hermes_ariadne@-.-> maintenance_ariadne gitea_http gitea_jenkins@-.->|SCM webhook| jenkins_service gitea_http gitea_flux@-.->|Flux webhook| flux_webhook jenkins_agents jenkins_gitea@-.->|Clone and fetch| gitea_http jenkins_agents jenkins_quality@-.->|Quality scan| quality_sonarqube jenkins_agents jenkins_harbor@-.->|Images and artifacts| harbor_registry flux_source flux_gitea@-.->|Desired state| gitea_ssh flux_image_reflector flux_harbor@-.->|Image metadata| harbor_registry flux_image_automation flux_commit@-.->|Manifest update| gitea_ssh flux_kustomize flux_apps@-.-> application_delivery flux_kustomize flux_personal@-.-> personal_delivery flux_kustomize flux_platform@-.-> platform_delivery application_state_clients app_postgres@-.-> postgres_service personal_state_clients personal_postgres@-.-> postgres_service platform_state_clients platform_postgres@-.-> postgres_service cloud_nextcloud nextcloud_mail@-.->|Mail delivery| mail_protocols quality_exporter quality_metrics@-.-> monitoring_victoria sui_metrics sui_telemetry@-.-> monitoring_victoria monitoring_victoria ananke_telemetry@-.-> ananke_hosts climate_typhon climate_source@--> tent_system climate_typhon climate_telemetry@-.-> monitoring_victoria class portal_identity,portal_chat_identity,cassandra_identity,element_identity,matrix_identity,budget_identity,firefly_identity,wolf_identity,wger_identity,chat_identity,jellyfin_identity,cloud_identity,outline_identity,planka_identity,gitops_identity,gitea_atlas_identity,gitea_cassandra_identity,harbor_identity,hermes_identity,jenkins_identity,logs_identity,longhorn_identity,grafana_identity,quality_identity,keycloak_identity,vault_identity routeIngress class portal_entry,portal_chat_entry,cassandra_entry,element_entry,matrix_entry,budget_entry,firefly_entry,wolf_entry,wger_entry,chat_entry,jellyfin_entry,cloud_entry,outline_entry,planka_entry,gitops_entry,gitea_atlas_entry,gitea_cassandra_entry,harbor_entry,hermes_entry,jenkins_entry,logs_entry,longhorn_entry,grafana_entry,quality_entry,keycloak_entry,vault_entry routeService class matrix_api,call_entry,livekit_entry,turn_entry,moonlight_entry,pegasus_entry,mail_web_entry,mail_protocol_entry,office_entry,vaultwarden_entry,monero_entry,gitea_ssh_entry,harbor_registry_entry,alerts_entry routeDirect class firefly_directory,wger_directory,jellyfin_directory routeAuth class app_postgres,personal_postgres,platform_postgres,nextcloud_mail,climate_source routeData class quality_metrics,sui_telemetry,ananke_telemetry,climate_telemetry routeTelemetry class website_automation,hermes_ariadne,gitea_jenkins,gitea_flux,jenkins_gitea,jenkins_quality,jenkins_harbor,flux_gitea,flux_harbor,flux_commit,flux_apps,flux_personal,flux_platform routeControl class website_model,hermes_chat_model,hermes_jenkins,hermes_metrics routeInternal end classDef domain fill:#16324f,stroke:#6cb6ff,color:#ffffff classDef user fill:#173f2b,stroke:#61d095,color:#ffffff classDef support fill:#30343b,stroke:#aab2bf,color:#ffffff classDef data fill:#3b2f52,stroke:#b79cff,color:#ffffff classDef ephemeral fill:#4a301e,stroke:#f0a35b,color:#ffffff,stroke-dasharray:6 3 classDef control fill:#3b354e,stroke:#c1a7ff,color:#ffffff classDef access fill:#213a56,stroke:#6cb6ff,color:#ffffff classDef oauth fill:#3b2f52,stroke:#c1a7ff,color:#ffffff classDef directory fill:#344a2d,stroke:#8ed081,color:#ffffff classDef external fill:#44301f,stroke:#ffb86c,color:#ffffff classDef linkIngress fill:#101820,stroke:#4ea1ff,color:#ffffff classDef linkService fill:#101820,stroke:#61d095,color:#ffffff classDef linkDirect fill:#101820,stroke:#e4bd55,color:#ffffff classDef linkAuth fill:#101820,stroke:#c1a7ff,color:#ffffff classDef linkData fill:#101820,stroke:#b79cff,color:#ffffff classDef linkTelemetry fill:#101820,stroke:#55c8d3,color:#ffffff classDef linkControl fill:#101820,stroke:#f0a35b,color:#ffffff classDef linkInternal fill:#101820,stroke:#aab2bf,color:#ffffff classDef routeIngress stroke:#4ea1ff,stroke-width:2.5px,color:#4ea1ff classDef routeService stroke:#61d095,stroke-width:2.5px,color:#61d095 classDef routeDirect stroke:#e4bd55,stroke-width:2.5px,color:#e4bd55 classDef routeAuth stroke:#c1a7ff,stroke-width:2.2px,color:#c1a7ff,stroke-dasharray:6 4 classDef routeData stroke:#b79cff,stroke-width:2.2px,color:#b79cff,stroke-dasharray:6 4 classDef routeTelemetry stroke:#55c8d3,stroke-width:2.2px,color:#55c8d3,stroke-dasharray:6 4 classDef routeControl stroke:#f0a35b,stroke-width:2.2px,color:#f0a35b,stroke-dasharray:6 4 classDef routeInternal stroke:#aab2bf,stroke-width:2px,color:#aab2bf,stroke-dasharray:5 4 style system fill:#000000,stroke:#8b95a5,stroke-width:2px style legend fill:#050505,stroke:#6d7485,stroke-width:1.5px style application_band fill:#02030d,stroke:#55c8d3,stroke-width:2px style personal_band fill:#06030d,stroke:#8ed081,stroke-width:2px style platform_band fill:#07040c,stroke:#c1a7ff,stroke-width:2px style shared_plane fill:#080604,stroke:#e4bd55,stroke-width:2px style external_systems fill:#080402,stroke:#ffb86c,stroke-width:2px